Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 01c2a8c

Browse files
Jami CogswellJami Cogswell
Jami Cogswell
authored and
Jami Cogswell
committed
add symm to the single config; still seems to work
1 parent 29de0c6 commit 01c2a8c

3 files changed

Lines changed: 28 additions & 15 deletions

File tree

‎java/ql/lib/semmle/code/java/security/InsufficientKeySizeQuery.qll‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,17 @@ import semmle.code.java.dataflow.TaintTracking
88
//import semmle.code.java.dataflow.FlowSources
99
//import semmle.code.java.dataflow.internal.DataFlowNodes
1010
/**
11-
* An Asymmetric (RSA, DSA, DH) key length data flow tracking configuration.
11+
* A key length data flow tracking configuration.
1212
*/
13-
class AsymmetricKeyTrackingConfiguration extends DataFlow::Configuration {
14-
AsymmetricKeyTrackingConfiguration() { this = "AsymmetricKeyTrackingConfiguration" }
13+
class KeyTrackingConfiguration extends DataFlow::Configuration {
14+
KeyTrackingConfiguration() { this = "KeyTrackingConfiguration" }
1515

1616
override predicate isSource(DataFlow::Node source, DataFlow::FlowState state) {
1717
//state instanceof DataFlow::FlowStateEmpty and
18+
// SYMMETRIC
19+
source.asExpr().(IntegerLiteral).getIntValue() < 128 and state = "128"
20+
or
21+
// ASYMMETRIC
1822
source.asExpr().(IntegerLiteral).getIntValue() < 2048 and state = "2048"
1923
or
2024
source.asExpr().(IntegerLiteral).getIntValue() < 256 and state = "256"
@@ -23,6 +27,16 @@ class AsymmetricKeyTrackingConfiguration extends DataFlow::Configuration {
2327
}
2428

2529
override predicate isSink(DataFlow::Node sink, DataFlow::FlowState state) {
30+
// SYMMETRIC
31+
exists(MethodAccess ma, JavaxCryptoKeyGenerator jcg |
32+
ma.getMethod() instanceof KeyGeneratorInitMethod and
33+
jcg.getAlgoSpec().(StringLiteral).getValue().toUpperCase() = "AES" and
34+
DataFlow::localExprFlow(jcg, ma.getQualifier()) and
35+
sink.asExpr() = ma.getArgument(0) and
36+
state = "128"
37+
)
38+
or
39+
// ASYMMETRIC
2640
exists(MethodAccess ma, JavaSecurityKeyPairGenerator jpg |
2741
ma.getMethod() instanceof KeyPairGeneratorInitMethod and
2842
(
@@ -67,6 +81,7 @@ class AsymmetricKeyTrackingConfiguration extends DataFlow::Configuration {
6781
)
6882
}
6983

84+
// ! FlowStates seem to work without even including a step like the below... hmmm
7085
override predicate isAdditionalFlowStep(
7186
DataFlow::Node node1, DataFlow::FlowState state1, DataFlow::Node node2,
7287
DataFlow::FlowState state2
@@ -76,7 +91,6 @@ class AsymmetricKeyTrackingConfiguration extends DataFlow::Configuration {
7691
state2 = intLiteral.toString() and
7792
node1.asExpr() = intLiteral and
7893
node2.asExpr() = intLiteral
79-
//intLiteral.toString().toInt() = 64 // test viability of this craziness
8094
)
8195
}
8296
}

‎java/ql/src/Security/CWE/CWE-326/InsufficientKeySize.ql‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,9 @@ import semmle.code.java.security.InsufficientKeySizeQuery
1616
import DataFlow::PathGraph
1717

1818
from DataFlow::PathNode source, DataFlow::PathNode sink
19-
where
20-
exists(AsymmetricKeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink))
21-
or
22-
// exists(AsymmetricNonECKeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink)) or
23-
// exists(AsymmetricECKeyTrackingConfiguration config2 | config2.hasFlowPath(source, sink)) or
24-
exists(SymmetricKeyTrackingConfiguration config3 | config3.hasFlowPath(source, sink))
19+
where exists(KeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink))
20+
//or
21+
// exists(AsymmetricNonECKeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink)) or
22+
// exists(AsymmetricECKeyTrackingConfiguration config2 | config2.hasFlowPath(source, sink)) or
23+
// exists(SymmetricKeyTrackingConfiguration config3 | config3.hasFlowPath(source, sink))
2524
select sink.getNode(), source, sink, "This $@ is too small.", source.getNode(), "key size"

‎java/ql/test/query-tests/security/CWE-326/InsufficientKeySizeTest.ql‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
import java
22
import TestUtilities.InlineExpectationsTest
33
import semmle.code.java.security.InsufficientKeySizeQuery
4-
import DataFlow::PathGraph
54

5+
//import DataFlow::PathGraph // Note: importing this messes up tests - adds edges and nodes to actual file...
66
class InsufficientKeySizeTest extends InlineExpectationsTest {
77
InsufficientKeySizeTest() { this = "InsufficientKeySize" }
88

@@ -11,12 +11,12 @@ class InsufficientKeySizeTest extends InlineExpectationsTest {
1111
override predicate hasActualResult(Location location, string element, string tag, string value) {
1212
tag = "hasInsufficientKeySize" and
1313
exists(DataFlow::PathNode source, DataFlow::PathNode sink |
14-
exists(AsymmetricKeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink))
15-
or
14+
exists(KeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink))
15+
|
16+
//or
1617
// exists(AsymmetricNonECKeyTrackingConfiguration config1 | config1.hasFlowPath(source, sink)) or
1718
// exists(AsymmetricECKeyTrackingConfiguration config2 | config2.hasFlowPath(source, sink)) or
18-
exists(SymmetricKeyTrackingConfiguration config3 | config3.hasFlowPath(source, sink))
19-
|
19+
//exists(SymmetricKeyTrackingConfiguration config3 | config3.hasFlowPath(source, sink))
2020
sink.getNode().getLocation() = location and
2121
element = sink.getNode().toString() and
2222
value = ""

0 commit comments

Comments
 (0)